Incorrect authorization in nix - CVE-2026-110451
Published: October 15, 2026
Vulnerability identifier: #VU155868
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-110451
CWE-ID: CWE-863
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to read arbitrary files on the host filesystem.
The vulnerability exists due to a logic error in the seatbelt sandbox policy generation component when splitting policies into chunks for sandboxed macOS derivation builds. A local user can supply a malicious derivation that bypasses the intended filesystem restrictions to read arbitrary files on the host filesystem.
Exploitation requires the Nix sandbox to be enabled, which is not the default configuration.
Affected software
nix
How to mitigate CVE-2026-110451
Install security update from vendor's website.
nix - addressed in versions 2.28.8, 2.30.6, 2.31.6, 2.34.9, 2.35.3